AWS CDK for operations teams

Install Node.js and the CDK CLI. Close and reopen PowerShell after the first line so the new PATH is picked up:

winget install OpenJS.NodeJS.LTS
npm install -g aws-cdk
node --version
cdk --version

You should see something like this:

v22.20.0
2.1031.0 (build 3c4d5e6)

1Give the CDK credentials and bootstrap

The CDK reads standard AWS credentials. Exporting the temporary credentials from your aws login session is the simplest way; they last about 15 minutes, so run these three lines again if you see ExpiredToken later.

Paste this whole block:

cd C:\aws-lab
aws login --profile saat-admin
aws configure export-credentials --profile saat-admin --format powershell | Invoke-Expression
Remove-Item Env:AWS_PROFILE -ErrorAction SilentlyContinue
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
$acct = aws sts get-caller-identity --query Account --output text
cdk bootstrap "aws://$($acct)/ap-south-1" --tags course=saatvedha-aws

You should see something like this (the first time takes two or three minutes):

 ⏳  Bootstrapping environment aws://111122223333/ap-south-1...
 ✅  Environment aws://111122223333/ap-south-1 bootstrapped.

Bootstrapping is once per account and Region. It creates the CDKToolkit stack; keep it for later lessons.

2Create the app and write the stack

Paste this whole block:

mkdir C:\aws-lab\saat-cdk | Out-Null
cd C:\aws-lab\saat-cdk
cdk init app --language typescript | Select-Object -Last 3
@'
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as s3 from 'aws-cdk-lib/aws-s3';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as ssm from 'aws-cdk-lib/aws-ssm';

export class SaatCdkStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = ec2.Vpc.fromLookup(this, 'SaatVpc', { vpcId: this.node.tryGetContext('vpcId') });

    const logs = new s3.Bucket(this, 'Logs', {
      encryption: s3.BucketEncryption.S3_MANAGED,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      enforceSSL: true,
      lifecycleRules: [{ expiration: cdk.Duration.days(30) }],
    });

    const sg = new ec2.SecurityGroup(this, 'WebSg', { vpc, description: 'Web tier from CDK' });
    sg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443), 'HTTPS from anywhere');

    const appRole = new iam.Role(this, 'AppRole', { assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com') });
    logs.grantRead(appRole);

    new ssm.StringParameter(this, 'LogBucketParam', { parameterName: '/saat/cdk/log-bucket', stringValue: logs.bucketName });

    cdk.Tags.of(this).add('course', 'saatvedha-aws');
    new cdk.CfnOutput(this, 'LogBucketName', { value: logs.bucketName });
  }
}
'@ | Set-Content lib\saat-cdk-stack.ts
@'
#!/usr/bin/env node
import * as cdk from 'aws-cdk-lib';
import { SaatCdkStack } from '../lib/saat-cdk-stack';

const app = new cdk.App();
new SaatCdkStack(app, 'SaatCdkStack', {
  env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: 'ap-south-1' },
});
'@ | Set-Content bin\saat-cdk.ts
cdk synth -c vpcId=$($v.VpcId) | Measure-Object -Line | Select-Object -ExpandProperty Lines
Get-Content cdk.context.json | Select-Object -First 3

You should see something like this:

✅ All done!
...
212
{
  "vpc-provider:account=111122223333:filter.vpc-id=vpc-0a1b2c3d4e5f67890:region=ap-south-1:returnAsymmetricSubnets=true": {
    "vpcId": "vpc-0a1b2c3d4e5f67890",

About 25 lines of TypeScript became a template of over 200 lines, including the bucket policy that enforces TLS and the IAM policy for grantRead. The VPC lookup result is cached in cdk.context.json; teams commit this file.

3Diff and deploy

Paste this, read the security changes it shows, then answer y:

cdk deploy -c vpcId=$($v.VpcId)

You should see something like this (after the IAM and security group change tables):

Do you wish to deploy these changes (y/n)? y
SaatCdkStack: deploying... [1/1]
SaatCdkStack: creating CloudFormation changeset...

 ✅  SaatCdkStack

Outputs:
SaatCdkStack.LogBucketName = saatcdkstack-logs1a2b3c4d-9z8y7x6w5v4u

The approval prompt appears whenever IAM or security groups change. In a pipeline you’d review the same information in the pull request. You can open CloudFormation and see SaatCdkStack like any other stack.

4Change the code and see the diff

Raise retention to 60 days, diff, and deploy:

(Get-Content lib\saat-cdk-stack.ts -Raw) -replace 'Duration.days\(30\)', 'Duration.days(60)' | Set-Content lib\saat-cdk-stack.ts
cdk diff -c vpcId=$($v.VpcId)
cdk deploy -c vpcId=$($v.VpcId) --require-approval never

You should see something like this:

Stack SaatCdkStack
Resources
[~] AWS::S3::Bucket Logs Logs6819BB44
 └─ [~] LifecycleConfiguration
     └─ [~] .Rules:
         - "ExpirationInDays": 30
         + "ExpirationInDays": 60

 ✅  SaatCdkStack

The diff shows one property on one resource, no replacement. --require-approval never is fine here because no IAM changed; keep the prompt (the default) for anything touching permissions.

✅ Checkpoint: CDK is installed, ap-south-1 is bootstrapped, SaatCdkStack deployed with a bucket, security group, role and parameter, and a diff showed the 30 to 60 day change before you deployed it. Keep the stack for the break lab.